Hyperlight: Virtual machine-based security for functions at scale
78 points by yoshuaw 11 hours ago | 16 comments
  • yoshuaw 11 hours ago |
    The Azure Upstream team has been working on a really fast hypervisor library written in Rust for the past three years. It does less than you'd conventionally do with hypervisors, but in turn it can start VMs around 2 orders of magnitude faster (around 1-2ms/VM).

    I think this is really cool, and the library was just released on GitHub for anyone to try. I’m happy I got to help them write their announcement post — and I figured this might be interesting for folks here!

    • dangoodmanUT 5 hours ago |
      Do you think requiring to use their packages is too limiting for widespread usage? Seems like you're forced to use Rust or C atm.

      This seems like a limitation that sits in a somewhat unusable place: For something simple and platform-specific (e.g. a HTTP transform) we can just use JS where the boot time perf makes up for the execution perf, and for something more serious like a full-fledged API 120ms should be more than enough time (and we can preemtively scale as long as we're not already at 0)

      • yoshuaw 4 hours ago |
        The way to think about Hyperlight is as a security substrate intended to host application runtimes. You’re right that the Hyperlight API only supports C and Rust today — but you can use that to for example load Python or JS runtimes which can then execute those languages natively.

        But we might be able to do even better than that by leveraging Wasm Components [1] and WASI 0.2 [2]. Using a VM guest based on Wasmtime, suddenly it becomes possible to run functions written in any language that can compile to Wasm Components — all using standard tooling and interfaces.

        I believe the team has a prototype VM guest based on Wasmtime working, but they still needed a little more time before it’s ready to be published. Stay tuned for future announcements?

        [1]: https://component-model.bytecodealliance.org/introduction.ht...

        [2]: https://wasi.dev

  • generalizations 9 hours ago |
    > These micro VMs operate without a kernel or operating system, keeping overhead low. Instead, guests are built specifically for Hyperlight using the Hyperlight Guest library, which provides a controlled set of APIs that facilitate interaction between host and guest

    Sounds like this is closer to a chroot/unikernel than a "micro VM" - a slightly more firewalled chroot without most of the os libs, or a unikernel without the kernel. Pretty sure it's not a "virtual machine" though.

    Only pointing this out because these sorts of containers/unikernels/vms exist on a spectrum, and each type carries its own strengths and limitations; calling this by the wrong name associates it with the wrong set of tradeoffs.

    • wmf 8 hours ago |
      I guess if it uses CR3 it's a "process" and if it uses VMLAUNCH it's a "VM".
      • generalizations 8 hours ago |
        Heh. Going by that delineation we end up with very VM-ish containers and (now) very container-ish VMs. Though this seems like it's even more stripped down than a unikernel - which would also be a "VM" here.
    • 0cf8612b2e1e 8 hours ago |
      I thought a chroot was not considered a real security boundary?
      • ronsor 5 hours ago |
        Chroot is a real security boundary as long as you use it properly. That said, namespaces on Linux are much superior at this point, so I can only recommend using `chroot` for POSIX compliance.
        • derefr 2 hours ago |
          chroot is great for all sorts of things, but they're not security-related.

          A lot of tools expect to do things to "your system" at absolute paths — chroot lets those tools operate against an explicitly wired-up semi-virtualized simulacra of your system, designed to pass through just the parts of those operations you want to your real host, while routing the rest of the effects into a "rootfs in a can", that you're either building up, or will immediately throw away.

          Think: debootstrap; or pivot-root; or mounting your rootfs to fix your GRUB config and re-run update-grub from your initramfs rescue shell.

  • apitman 8 hours ago |
    Don't see any mention of firecracker, which is the first thing I think of in this space. Anyone have a TL;DR comparison?
    • eyberg 6 hours ago |
      Firecracker can run ordinary linux/GPOS vms and unikernels.

      Unikernels can run inside of firecracker.

      Unikernels are focused on single applications whereas general purpose operating systems are focused on multiple applications.

      This is focused on running functions embedded inside a host program. So it is fairly different than other things out there and in a class of its own.

      • ATechGuy 5 hours ago |
        > each function request to have its own hypervisor for protection.

        They are talking about isolating serverless functions, not host program functions. In that sense, it is exactly what Firecracker does for lambda functions

        • eyberg 5 hours ago |
          Firecracker boots up a runtime that has a full blown operating system in it - lambda just happens to call a known program with a known function. In that sense sure it provides similar functionality but it's really quite different. That's not what fly uses firecracker for, for instance.

          Qemu/firecracker are in the same space - this is different.

          These are most definitely in a different boat as you embed the guest functions inside the host program and then you register those functions. Taken from the readme:

          > The host can call functions implemented and exposed by the guest (known as guest functions).

          > Once running, the guest can call functions implemented and exposed by the host (known as host functions).

          This is more in the 'safe plugin' type of space. As with most things in this space - the best way to learn about them is to simply try it out.

  • m3kw9 4 hours ago |
    What a loaded term, where do IT people come up with this stuff?
  • spankalee 3 hours ago |
    They mention that most guests are expected to run code in a VM/interpreter... I wonder if they have a build of V8 or JSC for their environment?
  • oneplane 3 hours ago |
    So in essence, this is somewhere between a unikernel+firecracker combo and a WASM module, but using VT.